diff --git a/vendor/yara/airbnb_binaryalert.yar b/vendor/yara/airbnb_binaryalert.yar index a65fe2c..39679d4 100644 --- a/vendor/yara/airbnb_binaryalert.yar +++ b/vendor/yara/airbnb_binaryalert.yar @@ -468,6 +468,7 @@ rule hacktool_windows_ncc_wmicmd description = "Command shell wrapper for WMI" reference = "https://github.com/nccgroup/WMIcmd" author = "@mimeframe" + type = "file" strings: $a1 = "Need to specify a username, domain and password for non local connections" wide ascii $a2 = "WS-Management is running on the remote host" wide ascii